1.2 Align Security Program with Organizational Governance ISSMP Practice Questions (Page 7)

Questions 31–35

1. 31foundation · easy

   What is the primary purpose of obtaining executive sponsorship for a security initiative?

   • ATo transfer all security responsibilities to the executive
   • BTo ensure the initiative is kept confidential
   • CTo secure the authority and resources needed for implementation
   • DTo eliminate the need for stakeholder engagement
   Reveal Solution Discussion Select an answer first
2. 32foundation · easy

   Which of the following is a key step in obtaining organizational support for a security initiative?

   • AWaiting for a security incident to occur before acting
   • BImplementing the initiative without informing stakeholders
   • CRequesting unlimited funding without justification
   • DDeveloping a business case that justifies the required budget and resources
   Reveal Solution Discussion Select an answer first
4. 33expert · hard

   A security manager needs to respond to a data breach that involves personal data of EU citizens. The company is based in the US but has operations in the EU. The manager must decide whether to notify the EU supervisory authority. What is the most appropriate source of authorization for this decision?

   • AThe company's incident response plan, which includes breach notification procedures
   • BThe CEO's directive to handle the breach quietly to avoid reputational damage
   • CThe EU General Data Protection Regulation (GDPR), which mandates breach notification to supervisory authorities
   • DThe company's legal department's opinion, as they are the authority on compliance
   Reveal Solution Discussion Select an answer first
5. 34expert · hard

   A security manager is advocating for a new security awareness program that includes regular phishing simulations. The CFO is concerned about the cost of the program, and the COO is concerned about the potential disruption to employees. The CEO is supportive but wants a clear business case. Which approach would most effectively secure approval?

   • AAsk the CEO to mandate the program to overcome resistance
   • BPresent a cost-benefit analysis showing the potential financial impact of a successful phishing attack
   • CEmphasize that phishing simulations are a best practice recommended by industry standards
   • DPropose a phased rollout that starts with a pilot in one department to minimize disruption and gather data
   Reveal Solution Discussion Select an answer first
6. 35application · medium

   A security manager needs to obtain approval to share threat intelligence data with a government agency. The company has a policy that requires all data sharing to be approved by the legal department. What is the legitimate source of authorization for this action?

   • AThe threat intelligence sharing community's best practices
   • BThe company's data sharing policy, which designates legal as the approving authority
   • CThe CISO's personal judgment that sharing is beneficial
   • DThe government agency's request for the data
   Reveal Solution Discussion Select an answer first